config jwt-aud should reject invalid URIs

[wolfgangwalther]

As noted in #1678 (comment) jwt-aud seems to not validate URIs at the moment.

This is unexpected, because accoding to the RFC, this should be of type StringOrUri - and once a : is part of the value, it must be a valid URI. We are validating those with Crypto.JWT: https://hackage.haskell.org/package/jose-0.8.4/docs/Crypto-JWT.html#g:5. Maybe we are not using it correctly.

[laurenceisla]

I think this is working OK now? The RFC Section-3 mentions that only the URI's schema and path are required (and even still, the path may be empty). With that in mind, these jwt-aud values work:

-- Debugging returns string
"hey"
-- Debugging returns URI
"a:hey"
"a:"
"a://hey"

While these fail and PostgREST does not start:

":hey"
"a//:m"

I must confess I didn't know a: was a valid URI according to the RFC.

[laurenceisla]

Reopen if i missed something.